Breaches and incidentsBriefReported by a reputable outlet, citing the company
TA419 impersonates Anthropic staff and ex-US officials to phish AI policy experts
Proofpoint (via Help Net Security): China-aligned TA419 impersonated a senior Anthropic employee in Feb 2026 (“Request for Feedback on Military Integration...
- Disclosed
What happened
- Proofpoint (via Help Net Security): China-aligned TA419 impersonated a senior Anthropic employee in Feb 2026 (“Request for Feedback on Military Integration of Claude”) and, from 8 Jul 2026, a former OSTP deputy director and a foreign-policy economist, targeting US think-tank, university and law-firm AI policy staff. Fewer than 10 targets per reporting; compromise not disclosed.
- Technique: benign first emails, then a short link to an AitM kit (fake OneDrive behind Turnstile, browser-in-the-browser Chrome window), relaying passwords and MFA and stealing session cookies.
- Attribution: Proofpoint, “likely supports wider Chinese intelligence objectives”.
Sources
- https://www.helpnetsecurity.com/2026/10/02/china-aligned-ta419-phishing-ai-policy-experts/
- https://www.nextgov.com/cybersecurity/2026/10/china-cyber-espionage-ta419-phishing-us-ai-policy-experts/416356/
- https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.